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REMARKS 

The Examiner has objected to the drawings. Proposed formal drawings are submitted 



The Examiner has objected to the claims. Such objections are deemed moot in view 
of the clarifications made to the claims hereinabove. 

The Examiner has rejected Claims 1, 2, 8, 9, 1 1, 12, 18, 19, 21, 22, 28, and 29 under , 
35 U.S.C. 102(b) as being anticipated by Nachenberg, U.S. Patent No. 5,826,013. Applicant 
respectfully disagrees with this rejection, especially in view of the clarifications made to the 
claims hereinabove. 

Specifically, the Examiner relies on the following excerpt from Nachenberg to make a 
prior art showing of applicant's claimed "calculating during said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said virus 
scanning operation." See all independem claims. 

"CDPE based methods employ additional heuristics to determine what 
the detection of various stoppers and boosters indicates about the 
code being emulated. For example, if a number of stoppers have been 
found prior to the detection of any boosters, the emulation control 
module will likely decide that the host file is uninfected. On the 
other hand r if one or more stoppers are detected following detection 
of a number of boosters, the emulation control module will likely 
decide that the polymorphic loop has been fully decrypted to reveal 
the static, virus body-- In .this case, -virus scanning will proceed." 
{col . 2, lines 15 - 25) 

It appears that the Examiner is not taking into consideration the full weight of 
applicant's claim language. Nachenberg merely suggests a type of virus scanning operation, 
namely counting the number of instruction sequences (i.e. boosters, stoppers, etc.), and 
determining whether a file is infected based on a comparison of such number with a 
threshold. Thus, such heuristic calculation is analogous to applicant's claimed "virus 
scanning operation." 

Nachenberg does not, however, disclose, teach or suggest calculating during a virus 
scanning operation a measurement value indicative of an amount of data processing 
performed during said virus scanning operation . As mentioned earlier, Nachenberg merely 



herewith. 
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counts predetermined instruction sequences. Such counts have no relation to "an amount of 
data processing performed during said virus scanning operation," as claimed. 

For example, in a first case scenario during use of the Nachenberg system, two of 
such predetermined instruction sequences may be located at a beginning of a file or be 
associated with a first set of tests, in which case the count will be indicative of a small 
amount of processing. Further, in a second case scenario, two of such predetermined 
instruction sequences may be located at an end of a file or be associated with a last set of 
tests, in which case the count will be indicative of a large amount of processing. Thus, it is 
clear that such count is not indicative, or based on, "an amount of data processing performed 
during said virus scanning operation," as claimed by applicant. 

In order to further distinguish this feature from the Nachenberg reference and further 
expedite the prosecution of the present application, applicant now claims in each of the 
independent claims "calculating during said virus scanning operation a measurement value 
indicative of an amount of data processing performed during said virus scanning operation* 
wherein the measurement value is based, at least in part, on at le ast one of a data size of the 
computer file and a complexity of tests of the virus scanning operation " and "triggering a 
break in said virus operation prior to completion of the tests to determine as to whether the 
computer file is infected , if said measurement value exceeds said threshold value to prevent 
overload of a virus scanner " (emphasis added). 

As is clear from the Nachenberg reference, Nacheriberg's measurement value is in no 
way based on an amount of data processing, in the manner now specifically claimed, for the 
specific purpose of preventing overload of a virus scanner. A notice of allowance or a 
specific prior art showing of such features, in combination with the remaining claim 
elements, is respectfully requested. 

The Examiner is reminded that a claim is anticipated only if each and every element 
as set forth in the claim is found, either expressly or inherently described in a single prior art 
reference. Verdegaal Bros. v. Union Oil Co, Of California, 814 F.2d 628, 631, 2 USPQ2d 
1051, 1053 (Fed. Cir. 1 987). Moreover, the identical invention must be shown in as complete 
detail as contained in the claim. Richardson v. Suzuki Motor Co.868 F.2d 1226, 1236, 
9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be arranged as required by the 
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claim. This criteria has simply not been met by the Nachenberg reference, especially in view 
of the amendments made hereinabove. 

With respect to some of the dependent claims, the Examiner has simply dismissed the 
same as being obvious without a prior art showing. See, for example, the rejection of Claims 
1 0, 20, and 30. It thus appears that the Examiner is invoking Official Notice. In response, 
applicant points out that such features (i.e. the summing feature, in the specific claimed 
context) provides for an optimal measurement value, for the reasons set forth in the originally 
filed specification. Applicant thus formally requests a specific showing of the subject matter 
in ALL of the claims in any future action. Note excerpt from MPEP below. 

"If the applicant traverses such an [Official Notice] assertion the examiner should cite 
a reference in support of his or her position." See MPEP 2144.03. 

Thus, all of the independent claims are deemed allowable. By virtue of their 
dependence on such independent claims, all of the remaining claims are further deemed 
allowable. Reconsideration is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. For payment of the 
fees due in connection with the filing of this paper, the Commissioner is authorized to charge 
such fees to Deposit Account No. 50-1351 (Order No. NAI1P157_00.091.01). 



P.O. Box 721120 

San Jose, CA 95172-1120 

Telephone: (408)505-5100 
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